Feeds

MS uses court order to take out Waledac botnet

Zombie network decapitated. For now

SANS - Survey on application security programs

Microsoft has won a court-issued take-down order against scores of domains associated with controlling the spam-spewing Waledac botnet.

The software giant's order allows the temporary cut-off of traffic to 277 Internet domains that form command and control nodes for the network of compromised machines. Infected (zombie) machines are programmed to regularly poll these control points for instructions and spam templates.

The .com domains, registered in China, will be sin-binned by VeriSign, at least temporarily decapitating the network. Microsoft estimates that Waledac was one of the 10 largest botnets in the US and a major distributor of spam for online (unlicensed) pharmacies, knock-off goods and other tat, as explained in a blog posting by its legal team here.

Waledac is estimated to have infected hundreds of thousands of computers around the world and, prior to this action, was believed to have the capacity to send over 1.5 billion spam emails per day. In a recent analysis, Microsoft found that between December 3-21, 2009, approximately 651 million spam emails attributable to Waledac were directed to Hotmail accounts alone, including offers and scams related to online pharmacies, imitation goods, jobs, penny stocks and more.

The Microsoft lawsuit also accuses 27 as-yet-unnamed defendants of cybercrime offences associated with the Waledac botnet.

Redmond's techies have followed up the legal action with "ethical countermeasures to downgrade much of the remaining peer-to-peer command and control communication" within the botnet, in partnership with its security firm partners.

Operation b49, as Microsoft dubs the Waledac takedown, still leaves the problem of hundreds of thousands of infected PCs, as Redmond readily acknowledges. Clean-up advice including a suggestion to try out Microsoft's malicious software removal tool is included in the bottom paragraphs of a blog post by Tim Cranton, associate general counsel at Microsoft, here.

Criminals running botnets have faced a number of takedown operations over the last year or so, dating back to the McColo shutdown. All normally result in a temporary slowdown in spam volumes. But cybercrooks are getting better at building more resilient networks. Even if that doesn't work, there are always more miscreants in the shadows ready to step in and sell bulk mail services to unethical, unscrupulous or outright criminal marketeers.

Microsoft's enforcement action is welcome, but it treats only the symptoms - and not the root cause - of the botnet epidemic. ®

High performance access to file storage

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Mounties always get their man: Heartbleed 'hacker', 19, CUFFED
Canadian teen accused of raiding tax computers using OpenSSL bug
Samsung Galaxy S5 fingerprint scanner hacked in just 4 DAYS
Sammy's newbie cooked slower than iPhone, also costs more to build
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Call of Duty 'fragged using OpenSSL's Heartbleed exploit'
So it begins ... or maybe not, says one analyst
prev story

Whitepapers

Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
SANS - Survey on application security programs
In this whitepaper learn about the state of application security programs and practices of 488 surveyed respondents, and discover how mature and effective these programs are.